WordPress Plugin Vulnerabilities

Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

Description

The plugin does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.

Proof of Concept

Affects Plugins

Plugin icon
woocommerce-checkout-manager
Fixed in 7.9.7

References

CVE
CVE-2026-87829

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
PO-WEI TING (Dinlon5566), Open Information Security Inc.
Submitter
PO-WEI TING (Dinlon5566)
Submitter website
https://dinlon5566.com
Verified
Yes
WPVDB ID
8c76bf99-5d3e-4573-a909-040a7ab36d68

Timeline

Publicly Published
2026-09-17 (about 9 hours ago)
Added
2026-09-17 (about 1 hour ago)
Last Updated
2026-09-17 (about 1 hour ago)

Other

Published
Title
Published
2025-03-24
Title
User Registration & Membership (Free < 4.1.2, Pro < 5.1.2) - Unauthenticated Privilege Escalation
Published
2026-02-18
Title
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure
Published
2025-01-14
Title
Piotnet Addons For Elementor < 2.4.33 - Authenticated (Contributor+) Post Disclosure
Published
2024-12-05
Title
PowerPack Elementor Addons (Free Widgets, Extensions and Templates) < 2.8.2 - Authenticated (Contributor+) Post Disclosure
Published
2022-11-12
Title
Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR